Your HR and Payroll compliance and policy solution! Comply with federal, state, and international laws, find answers to your most challenging questions, get timely updates with email alerts, and more with our suite of products.

In November 2012, Nationwide sent letters to some 1 million
policyholders and non-policyholders, informing them that its computer network
was hacked and that some of their personally identifiable information (PII) may
have been compromised.

The named plaintiffs in these related lawsuits
sued Nationwide on behalf of proposed classes, alleging violations of the Fair
Credit Reporting Act, 15 U.S.C. § 1681, negligence, invasion of privacy and
bailment.

Nationwide moved to dismiss, arguing that the plaintiffs
lacked standing because they failed to allege that they suffered an injury in
fact. The company also argued that the complaint should be dismissed for
failure to state a claim. Judge Michael H. Watson granted the motion and
dismissed the plaintiffs' claims.

The court first found that the
plaintiffs had no statutory standing under FCRA because they failed to allege
an injury arising from a specific requirement or prohibition in FCRA, instead
alleging that Nationwide violated the statute's general statement of purpose at
Section 1681(b).

The court then concluded that none of the plaintiffs'
claimed injuries--an increased risk of harm, the costs to mitigate that
increased risk, loss of privacy and deprivation of the value of PII--satisfied
the injury in fact requirement for Article III standing.

Risk of Harm,
Costs

The court compared the allegation of an increased risk of harm to
that in Clapper v. Amnesty International USA, 133 S. Ct. 1138, 2013 BL
50248 (2013). In that case, the U.S. Supreme Court held that a group of human
rights activists, journalists and lawyers lacked standing to challenge a
wiretapping program because their claims of injury were not “certainly
impending” .

Relying on Clapper, the court here held that “the
increased risk that Plaintiffs will be victims of identity theft, identity
fraud, medical fraud, or phishing at some indeterminate point in the future
does not constitute injury sufficient to confer standing where, as here, the
occurrence of such future injury rests on the criminal actions of independent
decisionmakers and where, as here, the Complaint lacks sufficient factual
allegations to show such future injury is imminent or certainly impending.”

Some allegations in the complaint demonstrate that such harm is not
certainly impending, the court said, pointing to the claim of a fraud incidence
rate of 19 percent in 2011 for consumers who received a data breach
notification. “An injury can hardly be said to be 'certainly impending' if
there is less than a 20% chance of it occurring,” the court said.

The
court added that its conclusion is supported by the decisions of many other
courts, such as Reilly v. Ceridian Corp., 664 F.3d 38, 2011 BL 313102
(3d Cir. 2011) . Although other courts, such as Krottner v. Starbucks
Corp., 628 F.3d 1139, 2010 BL 295445 (9th Cir. 2010) , have concluded
that an increased risk of theft or fraud is a concrete injury in fact for
purposes of standing, many of those decisions were decided before
Clapper, the court here said.

In addition, the plaintiffs “cannot
create standing by choosing to make expenditures in order to mitigate a purely
speculative harm,” the court said, again relying on Clapper. Other
courts, such as Reilly, have rejected such costs as injuries in the data
breach context, the court added.

Other Claimed Injuries

The
court also held that “even if deprivation of value of PII is an injury-in-fact,
Named Plaintiffs failed to allege deprivation of value of PII and therefore
lack standing.”

Although some federal district courts have concluded
that PII has no “inherent monetary value,” others have held that plaintiffs
must, at a minimum, allege facts demonstrating that they were deprived of that
value for purposes of standing, the court said. Here, the plaintiffs failed to
allege how the data breach prevents them from accessing the “cyber black
market” and selling their records for $14 to $25 each, the court explained.

The court also concluded that a loss of privacy is an insufficient injury
for standing for the plaintiffs' negligence and bailment claims, finding that
the plaintiffs failed to allege that the loss of privacy resulted in specific
adverse consequences.

Although the court found such an injury sufficient
to confer standing for the plaintiffs' state law invasion of privacy claim, it
granted the motion to dismiss that claim because the plaintiffs failed to
allege that Nationwide disclosed their PII or publicized their PII to the
general public.

All Bloomberg BNA treatises are available on standing order, which ensures you will always receive the most current edition of the book or supplement of the title you have ordered from Bloomberg BNA’s book division. As soon as a new supplement or edition is published (usually annually) for a title you’ve previously purchased and requested to be placed on standing order, we’ll ship it to you to review for 30 days without any obligation. During this period, you can either (a) honor the invoice and receive a 5% discount (in addition to any other discounts you may qualify for) off the then-current price of the update, plus shipping and handling or (b) return the book(s), in which case, your invoice will be cancelled upon receipt of the book(s). Call us for a prepaid UPS label for your return. It’s as simple and easy as that. Most importantly, standing orders mean you will never have to worry about the timeliness of the information you’re relying on. And, you may discontinue standing orders at any time by contacting us at 1.800.960.1220 or by sending an email to books@bna.com.

Put me on standing order at a 5% discount off list price of all future updates, in addition to any other discounts I may quality for. (Returnable within 30 days.)

Notify me when updates are available (No standing order will be created).

All Bloomberg BNA treatises are available on standing order, which ensures you will always receive the most current edition of the book or supplement of the title you have ordered from Bloomberg BNA’s book division. As soon as a new supplement or edition is published (usually annually) for a title you’ve previously purchased and requested to be placed on standing order, we’ll ship it to you to review for 30 days without any obligation. During this period, you can either (a) honor the invoice and receive a 5% discount (in addition to any other discounts you may qualify for) off the then-current price of the update, plus shipping and handling or (b) return the book(s), in which case, your invoice will be cancelled upon receipt of the book(s). Call us for a prepaid UPS label for your return. It’s as simple and easy as that. Most importantly, standing orders mean you will never have to worry about the timeliness of the information you’re relying on. And, you may discontinue standing orders at any time by contacting us at 1.800.960.1220 or by sending an email to books@bna.com.

Put me on standing order at a 5% discount off list price of all future updates, in addition to any other discounts I may quality for. (Returnable within 30 days.)

Notify me when updates are available (No standing order will be created).